Windows Error Reporting EUVD-2026-99358

Exploitation requires the attacker to already have local, interactive or code-execution access to the target Windows host with at least low-level authenticated privileges (PR:L) - it is not remotely reachable (AV:L). The flaw lies in the Windows Error Reporting component, so the attacker must be able to drive that component with attacker-controlled input to trigger the heap overflow. No user interaction is required (UI:N) and no non-default configuration is indicated - Windows Error Reporting is a standard OS feature. The principal limiting factor is the local-access and prior-authentication prerequisite: this is a privilege-escalation primitive useful after an initial foothold (e.g., phishing, stolen credentials, or existing malware), not an initial-access vector. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2 through 26H2 and 26H1), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD data.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation / code-execution flaw: the attacker must already have local access and at least low-level (authenticated) privileges, there is no user interaction, and complete compromise of confidentiality, integrity, and availability follows. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active exploitation - this is not a drop-everything internet-facing bug. EPSS and SSVC data were NOT provided in the input, so exploitation probability and the automatable/technical-impact decision cannot be quantified; this gap should be noted rather than assumed benign. The signals are internally consistent (local vector matches the 'execute code locally' description), so there is no contradiction to flag between CVSS and the description. Real-world weight comes almost entirely from the ubiquity of Windows plus the HIGH triad impact, not from any exploitation evidence: treat it as a standard monthly privilege-escalation patch to be rolled out on normal Patch-Tuesday cadence, prioritized on multi-user or shared hosts where low-privileged users are present.

A low-privileged user (or malware already running under a standard account) on a Windows host invokes the Windows Error Reporting component with crafted input that triggers a heap-based buffer overflow, corrupting heap memory to hijack execution. Because the scope is unchanged but impact is HIGH across C/I/A, successful exploitation yields code execution in a higher-privileged context, effectively escalating from a standard account to SYSTEM-level control. No public proof-of-concept or active exploitation is identified in the provided data.